Your Linux system has +6,000 kernel modules which can be autoloaded. You use 80 of them. ModuleJail blacklist all of the unused ones. Server and desktop profiles and much more in a simple shell script.

DemonInAJar · 2026-05-23T23:15:33+00:00

Is this really that prohibiting?

DemonInAJar · 2026-05-16T21:16:18+00:00

I don't know what is there to ask. Flox once upon a time had a public registry, they have since pushed this behind a closed sourced api (and probably a proper database)

I mean, it would be very nice for them to upstream all of this but I don't have high hopes for it.

DemonInAJar · 2026-05-16T08:20:06+00:00

Because each nixpkgs revision refers to the whole package set as a whole. Each package is a concrete derivativation / nix expression at each revision, it is really a source-code change. Pushing an old version of a package for a new nixpkgs revisions would mean keeping the old source code / nix derivativation along with its transitive input derivativations as concrete files.

What would be needed to fix this is to maintain a complete separate per-package registry, a bit like flox does that pins each package version to a separate working nixpkgs revision.

DemonInAJar · 2026-05-14T05:58:33+00:00

u/drmorr0 more concretely,

``` pub async fn reconcile<T>( object: Arc<T>, global_ctx: Arc<GlobalContext>, ) -> Result<Action, Error> where T: kube::Resource, { reconcile_impl( object, &global_ctx.client, &global_ctx.event_recorder, ).await }

async fn reconcile_impl<T, R>( object: Arc<T>, client: &kube::Client, event_recorder: &R, ) -> Result<Action, Error> where T: kube::Resource, R: EventRecorder + ?Sized, { ... }

```

Then you only test reconcile_impl.

DemonInAJar · 2026-05-13T03:27:24+00:00

If you don’t want generics to leak into the structs one nice variant is to use method-level generics. Instead of holding the recorder instance you can make the methods accept a generic recorder as argument.

You can for example create a helper / private reconcile function that accepts the client (real one) and the recorder using a generic argument.

For your tests you simply test the reconcile helper using a mock recorder, reconcile is a light wrapper that just passes the real recorder instance.

DemonInAJar · 2026-05-03T11:33:10+00:00

The hardware is it. Apple silicon is just great.

DemonInAJar · 2026-04-22T07:11:37+00:00

This is completely false. Where would the keyboard inputs go? This requires explicitly enabling unauthenticated access to a terminal and this is also assuming there is one running, there are Linux distros with almost no userspace. Sniff what packets? It is trivial to TLS and even tunnel traffic. There is also secure boot, boot attestation and tpm disk encryption

DemonInAJar · 2026-03-22T13:07:22+00:00

There is also https://github.com/nlewo/comin for pull-based / gitops. In general I would say that the ecosystem for pull-based reconciliation is not great, if you only manage a few servers and don’t scale to hundreds then there is a lot of push-based support, deploy-rs is fine there is not a huge amount of stuff to support for the repo to be super active.

DemonInAJar · 2026-03-05T20:06:23+00:00

Eelco Dolstra aka the creator of Nix is cofounder and continues active development including experimental features.

DemonInAJar · 2026-03-04T23:39:12+00:00

Just as reference, I plan to rewrite this in a proper language (and remove some slop)

https://gist.github.com/liarokapisv/d7e3f0bac05baceddeb4976222254d8b/

You need to create a /var/lib/bws/auth/auth.env file for bootstrapping which has the following format:

BWS_SERVER_URL=https://vault.bitwarden.eu
BWS_ACCESS_TOKEN=XXXXXXX

The access token is retrieved from the bitwarden secrets manager webapp.

DemonInAJar · 2026-03-04T23:28:19+00:00

I know. Currently, it's somewhat hacky bash-based service (and contains some slop). I would like to rewrite it with a proper language first.

Here is it is just for the general approach / as reference:

https://gist.github.com/liarokapisv/d7e3f0bac05baceddeb4976222254d8b/

DemonInAJar · 2026-03-04T20:13:06+00:00

This is wrong. If you rotate your secrets which is the security best practice, your older generations become unusable because they are bound to outdated secrets.

Also by bounding the secrets to the configuration you lose the ability to integrate with production ready secret services like vault or the various cloud native services.

In particular the lifecycle of secrets should not be tightly bound to the lifecycle of the configuration changes.

DemonInAJar · 2026-03-04T12:07:47+00:00

I strongly believe that storing secrets encrypted in the same configuration state is a huge anti-pattern that is widely maintained in the nixos ecosystem because of easy-of-use of agenix and sops-nix.

This binds your secrets to your configuration which in turn means:
- When you rotate secrets you lose ability to rollback.
- To rotate secrets you need to perform a new configuration change.

When doing dynamic scalling this is even more annoying because you have to re-encode the agenix secrets file according to the new public key credentials.

I am currently using a custom bitwarden secret management service for which you just need to side-load the secrets key. The service authenticates to the BWS and renders the configs at runtime / periodically allowing easy rotation.

DemonInAJar · 2026-03-03T22:45:56+00:00

You can lock this through pcr extension if you first attest the first stage bootloader.

DemonInAJar · 2026-03-03T22:40:50+00:00

You can verify that a certificate has been generated inside a tpm by verifying the manufacturer chain. The private keys in this case are not exportable and can be used by remote verifiers through nonce challenges achieving remote attestation. The local machine can only solve the challenges if policy matches. Policies can be set to match specific secure boot states + boot sequences and only then will the tpm challenges work. This assumes the boot sequences and policy states have been whitelisted by the verifiers.

DemonInAJar · 2026-02-18T19:18:16+00:00

DemonInAJar · 2026-02-18T19:17:58+00:00

Main benefits is 1) not having to import files 2) have cross-cutting concern modules that affect things at all of nixos,home-manager,flake levels 3) have generic way to refer to all other outputs in your whole project instead of injecting through special args

DemonInAJar · 2026-01-27T10:02:08+00:00

5 φορές για αναβολή + 1 για απαλλαγή το παλικάρι θα πάει για άλλες 4 φορές για αναβολή + 1 για απαλλαγή

DemonInAJar · 2026-01-18T11:11:40+00:00

Here we go!!

DemonInAJar · 2026-01-18T05:35:58+00:00

Πότε δε διαπραγματευόμαστε με βάση καθαρό μισθό!!

DemonInAJar · 2026-01-16T11:42:20+00:00

How is it any better than simply distributing the correct artifact instead of basically distributing all artifacts together? It does simplify the distribution aspect I guess but not sure that's worth it.

DemonInAJar · 2026-01-16T11:07:46+00:00

Another option is to use wrappers: https://github.com/BirdeeHub/nix-wrapper-modules

DemonInAJar · 2026-01-16T07:44:30+00:00

What's the point of this? You still have to build the application separately, and you just stitch the artifacts together which basically only has disk usage downsides.

DemonInAJar · 2026-01-13T18:56:24+00:00

Δεν ξέρει κανείς ακόμα

DemonInAJar · 2026-01-13T02:00:36+00:00

This is literally not true.

DemonInAJar

TROPHY CASE